@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/keeweb/status.ts

@@ -1,359 +0,0 @@
-import type {goke} from 'goke'
-
-import type {ActionCtx} from '../../lib/action-ctx'
-import type {StatusSummary} from '../status'
-
-import path from 'node:path'
-import {z} from 'zod'
-
-const SITE_URL = 'https://kw.igg.ms/'
-const GH_REPO = 'marcusrbrown/infra'
-const HTTP_TIMEOUT_MS = 10_000
-
-type CheckLevel = 'ok' | 'info' | 'warning' | 'error'
-
-interface CheckResult {
-  title: string
-  level: CheckLevel
-  summary: string
-  details?: string[]
-}
-
-const ghRunSchema = z.array(
-  z.object({
-    createdAt: z.string().min(1),
-    url: z.url(),
-  }),
-)
-
-function levelLabel(level: CheckLevel): string {
-  if (level === 'ok') {
-    return 'OK'
-  }
-
-  if (level === 'info') {
-    return 'INFO'
-  }
-
-  if (level === 'warning') {
-    return 'WARN'
-  }
-
-  return 'ERROR'
-}
-
-export function formatDurationMs(durationMs: number): string {
-  return `${Math.max(0, Math.round(durationMs))}ms`
-}
-
-export function formatDate(value: string): string {
-  const date = new Date(value)
-  if (Number.isNaN(date.getTime())) {
-    return value
-  }
-
-  return date.toLocaleString()
-}
-
-export function hashSha256(value: string): string {
-  const hasher = new Bun.CryptoHasher('sha256')
-  hasher.update(value)
-  return hasher.digest('hex')
-}
-
-async function streamToText(stream?: ReadableStream<Uint8Array> | null): Promise<string> {
-  if (!stream) {
-    return ''
-  }
-
-  return await new Response(stream).text()
-}
-
-export async function checkHttpReachability(verbose: boolean): Promise<CheckResult> {
-  const startedAt = performance.now()
-
-  try {
-    const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-    })
-    const elapsedMs = performance.now() - startedAt
-    const details: string[] = []
-
-    if (verbose) {
-      details.push(`URL: ${SITE_URL}`)
-      details.push(`Status text: ${response.statusText || '(none)'}`)
-
-      if (response.headers.get('content-type')) {
-        details.push(`Content-Type: ${response.headers.get('content-type')}`)
-      }
-
-      if (response.headers.get('server')) {
-        details.push(`Server: ${response.headers.get('server')}`)
-      }
-    }
-
-    return {
-      title: 'HTTP reachability',
-      level: response.ok ? 'ok' : 'error',
-      summary: `GET ${SITE_URL} → ${response.status} (${formatDurationMs(elapsedMs)})`,
-      details,
-    }
-  } catch (error) {
-    const elapsedMs = performance.now() - startedAt
-    const message = error instanceof Error ? error.message : String(error)
-
-    return {
-      title: 'HTTP reachability',
-      level: 'error',
-      summary: `Request failed after ${formatDurationMs(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${SITE_URL}`, `Timeout: ${HTTP_TIMEOUT_MS}ms`] : undefined,
-    }
-  }
-}
-
-export async function checkLastDeploy(verbose: boolean): Promise<CheckResult> {
-  try {
-    const proc = Bun.spawn(
-      [
-        'gh',
-        'run',
-        'list',
-        '--workflow=Deploy KeeWeb',
-        '--status=success',
-        '--limit=1',
-        '--json',
-        'createdAt,url',
-        '--repo',
-        GH_REPO,
-      ],
-      {
-        stderr: 'pipe',
-        stdout: 'pipe',
-      },
-    )
-
-    const [exitCode, stdout, stderr] = await Promise.all([
-      proc.exited,
-      streamToText(proc.stdout),
-      streamToText(proc.stderr),
-    ])
-
-    if (exitCode !== 0) {
-      const baseDetails = stderr.trim() ? [stderr.trim()] : []
-      const verboseDetails = verbose && stdout.trim() ? [...baseDetails, `Raw stdout: ${stdout.trim()}`] : baseDetails
-
-      return {
-        title: 'Last successful deploy',
-        level: 'warning',
-        summary: `Unable to query GitHub Actions (gh exited ${exitCode})`,
-        details: verboseDetails,
-      }
-    }
-
-    const parsed = ghRunSchema.safeParse(JSON.parse(stdout))
-    if (!parsed.success) {
-      return {
-        title: 'Last successful deploy',
-        level: 'warning',
-        summary: 'GitHub CLI output did not match expected schema',
-        details: verbose ? [parsed.error.message, `Raw stdout: ${stdout.trim()}`] : undefined,
-      }
-    }
-
-    const [latestRun] = parsed.data
-
-    if (!latestRun) {
-      return {
-        title: 'Last successful deploy',
-        level: 'warning',
-        summary: 'No successful Deploy KeeWeb workflow runs found',
-      }
-    }
-
-    const details = [`Run URL: ${latestRun.url}`]
-
-    if (verbose) {
-      details.push(`Raw createdAt: ${latestRun.createdAt}`)
-    }
-
-    return {
-      title: 'Last successful deploy',
-      level: 'ok',
-      summary: `${formatDate(latestRun.createdAt)}`,
-      details,
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-
-    return {
-      title: 'Last successful deploy',
-      level: 'warning',
-      summary: `Unable to query GitHub Actions: ${message}`,
-      details: verbose
-        ? ['Requires GitHub CLI authenticated with access to marcusrbrown/infra', 'Install: https://cli.github.com/']
-        : undefined,
-    }
-  }
-}
-
-/**
- * Detect whether moduleDir belongs to a source checkout of this monorepo.
- *
- * A source checkout has the repo root at 5 levels above the keeweb command
- * directory (packages/cli/src/commands/keeweb → repo root). We confirm the
- * layout by checking for a source-only marker file that is never shipped in
- * the CLI package. This is more robust than checking for `node_modules` in
- * the path, which misses unpacked tarballs and global-style installs.
- */
-async function isSourceCheckout(resolvedModuleDir: string): Promise<boolean> {
-  // Candidate repo root is 5 levels up from packages/cli/src/commands/keeweb
-  const candidateRoot = path.resolve(resolvedModuleDir, '../../../../../')
-  // apps/keeweb/src/build.ts is a source-only file never included in the CLI package
-  const sourceMarker = path.join(candidateRoot, 'apps', 'keeweb', 'src', 'build.ts')
-  return Bun.file(sourceMarker).exists()
-}
-
-export async function checkContentHash(verbose: boolean, moduleDir?: string): Promise<CheckResult> {
-  const resolvedModuleDir = moduleDir ?? import.meta.dir
-  const distIndexPath = path.resolve(resolvedModuleDir, '../../../../../apps/keeweb/dist/index.html')
-
-  // When running from a packaged install (bunx, npm global, unpacked tarball, etc.),
-  // the resolved path has no repo apps/keeweb source tree — the KeeWeb dist is not
-  // shipped with the CLI package. Emit a clean, non-path-noisy message instead of
-  // a scary temp path. We detect source checkout by looking for a source-only marker
-  // file rather than relying on `node_modules` in the path (which misses tarballs).
-  const sourceCheckout = await isSourceCheckout(resolvedModuleDir)
-  if (!sourceCheckout) {
-    return {
-      title: 'Content hash',
-      level: 'info',
-      summary: 'Content hash not available: local KeeWeb dist is only present in a source checkout',
-      details: verbose
-        ? ['Clone the repo and run: bun run --cwd apps/keeweb build', 'Then re-run status from the source checkout']
-        : undefined,
-    }
-  }
-
-  const localFile = Bun.file(distIndexPath)
-  const localExists = await localFile.exists()
-
-  if (!localExists) {
-    return {
-      title: 'Content hash',
-      level: 'warning',
-      summary: `Local dist file not found: ${distIndexPath}`,
-      details: ['Run: bun run --cwd apps/keeweb build'],
-    }
-  }
-
-  try {
-    const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-    })
-
-    if (!response.ok) {
-      return {
-        title: 'Content hash',
-        level: 'warning',
-        summary: `Could not fetch remote index.html (HTTP ${response.status})`,
-        details: verbose ? [`URL: ${SITE_URL}`] : undefined,
-      }
-    }
-
-    const [remoteBody, localBody] = await Promise.all([response.text(), localFile.text()])
-    const remoteHash = hashSha256(remoteBody)
-    const localHash = hashSha256(localBody)
-
-    const details = verbose ? [`Remote SHA-256: ${remoteHash}`, `Local SHA-256: ${localHash}`] : undefined
-
-    if (remoteHash === localHash) {
-      return {
-        title: 'Content hash',
-        level: 'ok',
-        summary: 'Remote index.html matches local dist/index.html',
-        details,
-      }
-    }
-
-    return {
-      title: 'Content hash',
-      level: 'warning',
-      summary: 'Remote index.html differs from local dist/index.html',
-      details,
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-    return {
-      title: 'Content hash',
-      level: 'warning',
-      summary: `Could not compare hashes: ${message}`,
-      details: verbose ? [`URL: ${SITE_URL}`, `Local path: ${distIndexPath}`] : undefined,
-    }
-  }
-}
-
-function printCheckResult(result: CheckResult, ctx: ActionCtx): void {
-  ctx.console.log(`[${levelLabel(result.level)}] ${result.title}`)
-  ctx.console.log(`  ${result.summary}`)
-
-  if (result.details && result.details.length > 0) {
-    for (const detail of result.details) {
-      ctx.console.log(`  - ${detail}`)
-    }
-  }
-}
-
-function formatCheckSummary(result: CheckResult): string {
-  return `${levelLabel(result.level)}: ${result.summary}`
-}
-
-export async function getKeewebStatusSummary(verbose: boolean): Promise<StatusSummary> {
-  const [httpResult, lastDeployResult, contentHashResult] = await Promise.all([
-    checkHttpReachability(verbose),
-    checkLastDeploy(verbose),
-    checkContentHash(verbose),
-  ])
-
-  return {
-    app: 'keeweb',
-    http: formatCheckSummary(httpResult),
-    lastDeploy: formatCheckSummary(lastDeployResult),
-    version: '—',
-    contentHash: formatCheckSummary(contentHashResult),
-    usageStats: '—',
-  }
-}
-
-export async function keewebStatusAction(options: {verbose?: boolean}, ctx: ActionCtx): Promise<void> {
-  const verbose = options.verbose === true
-
-  ctx.console.log('KeeWeb status')
-  ctx.console.log('')
-
-  const results = await Promise.all([
-    checkHttpReachability(verbose),
-    checkLastDeploy(verbose),
-    checkContentHash(verbose),
-  ])
-
-  for (const result of results) {
-    printCheckResult(result, ctx)
-    ctx.console.log('')
-  }
-
-  const errorCount = results.filter(result => result.level === 'error').length
-  const warningCount = results.filter(result => result.level === 'warning').length
-
-  ctx.console.log(`Summary: ${results.length} checks, ${errorCount} errors, ${warningCount} warnings`)
-
-  if (errorCount > 0) {
-    ctx.process.exit(1)
-  }
-}
-
-export function registerKeewebStatus(cli: ReturnType<typeof goke>): void {
-  cli
-    .command('keeweb status', 'Show operational health of the KeeWeb deployment')
-    .option('--verbose', 'Enable verbose output for all commands')
-    .action(keewebStatusAction)
-}

package/src/commands/mcp.test.ts

@@ -1,260 +0,0 @@
-/**
- * Tier-1 in-process MCP integration test.
- *
- * Uses @modelcontextprotocol/sdk's InMemoryTransport to spin up the MCP server
- * in-process (no subprocess) and assert the tool list + call contracts.
- *
- * // FALLBACK: If InMemoryTransport proves incompatible with @goke/mcp@0.0.10's
- * // transport injection in a future SDK version, switch to subprocess mode:
- * //
- * //   const proc = Bun.spawn(['bun', 'run', 'packages/cli/src/cli.ts', 'mcp'], {
- * //     stdin: 'pipe',
- * //     stdout: 'pipe',
- * //     stderr: 'pipe',
- * //   })
- * //   const transport = new StdioClientTransport({
- * //     readable: proc.stdout,
- * //     writable: proc.stdin,
- * //   })
- * //   const client = new Client({name: 'test-client', version: '1.0.0'}, {capabilities: {}})
- * //   await client.connect(transport)
- * //   // ... same assertions below ...
- * //   await client.close()
- * //   proc.kill()
- */
-
-import {createMcpAction} from '@goke/mcp'
-import {Client} from '@modelcontextprotocol/sdk/client'
-import {InMemoryTransport} from '@modelcontextprotocol/sdk/inMemory.js'
-import {afterAll, afterEach, beforeAll, beforeEach, describe, expect, test} from 'bun:test'
-import {goke} from 'goke'
-
-import {registerCliproxyCommands} from './cliproxy'
-import {registerDashboardCommands} from './dashboard'
-import {registerGatewayCommands} from './gateway'
-import {registerKeewebCommands} from './keeweb'
-import {MCP_ALLOWLIST, registerMcp} from './mcp'
-import {registerStatus} from './status'
-import {registerUmamiCommands} from './umami'
-import {registerVpnCommands} from './vpn'
-
-// ─── Tool name constants ──────────────────────────────────────────────────────
-
-/**
- * The MCP tool surface, pinned as an INDEPENDENT literal (deliberately NOT
- * derived from MCP_ALLOWLIST) so allowlist drift surfaces as a test failure —
- * per the Tier-1 test bar in packages/cli/AGENTS.md. Seven read-only tools.
- */
-const EXPECTED_TOOLS = [
-  'cliproxy_models',
-  'cliproxy_status',
-  'dashboard_status',
-  'gateway_status',
-  'keeweb_status',
-  'status',
-  'umami_status',
-  'vpn_status',
-].sort()
-
-/**
- * CLI-only commands that must NOT appear in the MCP tool list: the
- * non-interactive/streaming-only commands plus the source-gated sensitive
- * commands (mutating or secret-disclosing).
- */
-const CLI_ONLY_TOOLS = [
-  // Non-interactive / streaming — excluded since before the source-gate change
-  'cliproxy_deploy',
-  'cliproxy_login',
-  'cliproxy_open',
-  'cliproxy_setup',
-  'dashboard_deploy',
-  'dashboard_logs',
-  'gateway_deploy',
-  'gateway_logs',
-  'gateway_restore',
-  'keeweb_deploy',
-  'keeweb_open',
-  'umami_deploy',
-  'umami_logs',
-  // Source-gated sensitive commands (mutating or secret-disclosing)
-  'gateway_backup',
-  'cliproxy_keys_list',
-  'cliproxy_keys_add',
-  'cliproxy_keys_remove',
-  'cliproxy_config_get',
-  'cliproxy_config_set',
-  // VPN: mutating / sensitive / log-streaming — CLI-only
-  'vpn_deploy',
-  'vpn_logs',
-  'vpn_client_add',
-  'vpn_client_list',
-  'vpn_client_remove',
-].sort()
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-function buildTestCli(): ReturnType<typeof goke> {
-  const cli = goke('infra')
-  cli.option('--verbose', 'Enable verbose output for all commands')
-  registerKeewebCommands(cli)
-  registerCliproxyCommands(cli)
-  registerGatewayCommands(cli)
-  registerUmamiCommands(cli)
-  registerDashboardCommands(cli)
-  registerVpnCommands(cli)
-  registerStatus(cli)
-  registerMcp(cli)
-  return cli
-}
-
-// ─── Suite ────────────────────────────────────────────────────────────────────
-
-describe('mcp integration (Tier-1, in-process)', () => {
-  let client: Client
-
-  beforeAll(async () => {
-    const cli = buildTestCli()
-
-    // Simulate goke having matched the 'mcp' command so createMcpAction
-    // auto-excludes it from the tool list (it reads cli.matchedCommandName).
-    cli.matchedCommandName = 'mcp'
-
-    const [serverTransport, clientTransport] = InMemoryTransport.createLinkedPair()
-
-    // createMcpAction supports a custom createTransport factory (Option A).
-    // We inject the in-memory server transport so no stdio is involved.
-    const mcpAction = createMcpAction({
-      cli,
-      commandFilter: (name: string) => MCP_ALLOWLIST.has(name),
-      createTransport: () => serverTransport,
-    })
-
-    // Start the server (non-blocking — server.connect() resolves once the
-    // transport handshake completes, then the server listens for requests).
-    await mcpAction()
-
-    client = new Client({name: 'test-client', version: '1.0.0'}, {capabilities: {}})
-    await client.connect(clientTransport)
-  })
-
-  afterAll(async () => {
-    await client?.close()
-  })
-
-  // ── tools/list assertions ──────────────────────────────────────────────────
-
-  test('tools/list returns exactly the allowlist tool names', async () => {
-    const result = await client.listTools()
-    const names = result.tools.map((t: {name: string}) => t.name).sort()
-    expect(names).toEqual(EXPECTED_TOOLS)
-  })
-
-  test('source-gated sensitive commands are absent from the MCP tool list', async () => {
-    const result = await client.listTools()
-    const names = new Set(result.tools.map((t: {name: string}) => t.name))
-    for (const excluded of CLI_ONLY_TOOLS) {
-      expect(names.has(excluded)).toBe(false)
-    }
-  })
-})
-
-// ─── cliproxy_models end-to-end call (Tier-1, in-process) ────────────────────
-
-const MODELS_RESPONSE = {
-  object: 'list',
-  data: [
-    {id: 'claude-opus-4', object: 'model', owned_by: 'anthropic', created: 1_710_000_000},
-    {id: 'claude-sonnet-4-5', object: 'model', owned_by: 'anthropic', created: 1_715_000_000},
-    {id: 'gpt-4o', object: 'model', owned_by: 'openai', created: 1_705_000_000},
-  ],
-}
-
-type FetchReplacement = (url: string, init?: RequestInit) => Promise<Response>
-
-function createFetchImplementation(handler: FetchReplacement): typeof fetch {
-  const originalFetch = globalThis.fetch
-  return Object.assign(
-    (input: string | URL | Request, init?: RequestInit) => {
-      if (typeof input !== 'string') {
-        throw new TypeError(`Unexpected non-string fetch input: ${String(input)}`)
-      }
-
-      return handler(input, init)
-    },
-    {preconnect: originalFetch.preconnect},
-  )
-}
-
-describe('cliproxy_models MCP tool (Tier-1, in-process call)', () => {
-  let callClient: Client
-  const originalFetch = globalThis.fetch
-  let savedApiKey: string | undefined
-
-  beforeAll(async () => {
-    const cli = buildTestCli()
-    cli.matchedCommandName = 'mcp'
-
-    const [serverTransport, clientTransport] = InMemoryTransport.createLinkedPair()
-
-    const mcpAction = createMcpAction({
-      cli,
-      commandFilter: (name: string) => MCP_ALLOWLIST.has(name),
-      createTransport: () => serverTransport,
-    })
-
-    await mcpAction()
-
-    callClient = new Client({name: 'test-client-models', version: '1.0.0'}, {capabilities: {}})
-    await callClient.connect(clientTransport)
-  })
-
-  afterAll(async () => {
-    await callClient?.close()
-  })
-
-  beforeEach(() => {
-    savedApiKey = process.env.CLIPROXY_API_KEY
-    process.env.CLIPROXY_API_KEY = 'test-mcp-api-key'
-  })
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch
-    if (savedApiKey === undefined) {
-      delete process.env.CLIPROXY_API_KEY
-    } else {
-      process.env.CLIPROXY_API_KEY = savedApiKey
-    }
-  })
-
-  test('listTools() includes cliproxy_models', async () => {
-    const result = await callClient.listTools()
-    const names = result.tools.map((t: {name: string}) => t.name)
-    expect(names).toContain('cliproxy_models')
-  })
-
-  test('calling cliproxy_models returns captured model-list text with expected model ids', async () => {
-    globalThis.fetch = createFetchImplementation(async url => {
-      if (url.includes('/v1/models')) {
-        return new Response(JSON.stringify(MODELS_RESPONSE), {
-          status: 200,
-          headers: {'content-type': 'application/json'},
-        })
-      }
-
-      throw new Error(`Unexpected fetch: ${url}`)
-    })
-
-    const result = await callClient.callTool({name: 'cliproxy_models', arguments: {}})
-
-    // MCP tool result is an array of content blocks; join text content for assertion
-    const content = result.content as {type: string; text?: string}[]
-    const text = content
-      .filter(c => c.type === 'text')
-      .map(c => c.text ?? '')
-      .join('\n')
-
-    expect(text).toContain('claude-opus-4')
-    expect(text).toContain('claude-sonnet-4-5')
-    expect(text).toContain('gpt-4o')
-  })
-})

package/src/commands/mcp.ts

@@ -1,58 +0,0 @@
-import type {goke} from 'goke'
-import {createMcpAction} from '@goke/mcp'
-
-/**
- * Commands intentionally excluded from MCP exposure (not in MCP_ALLOWLIST):
- *
- * Infrastructure / streaming (deferred or not MCP-suitable):
- * - `gateway deploy`   — subprocess streaming (Bun.spawn with stdout: 'inherit'), deferred to MCP v2 (#291)
- * - `cliproxy deploy`  — subprocess streaming, deferred to MCP v2 (#291)
- * - `keeweb deploy`    — subprocess streaming, deferred to MCP v2 (#291)
- * - `gateway logs`     — subprocess streaming, deferred to MCP v2 (#291)
- * - `cliproxy login`   — interactive (OAuth callback URL paste, requires TTY)
- * - `cliproxy open`    — interactive (SSH TUI session, requires TTY)
- * - `cliproxy setup`   — interactive (@clack/prompts wizard, requires TTY)
- * - `gateway restore`  — destructive policy (replaces mitmproxy CA on live gateway, deferred to MCP v2 #292)
- * - `keeweb open`      — host-machine side effect (spawns local browser, requires user intent)
- * - `umami deploy`     — intentionally CLI-only: mutates live deployment and requires environment approval
- * - `umami logs`       — intentionally CLI-only: streams logs that may emit sensitive data (DB passwords, app secrets)
- * - `dashboard deploy` — intentionally CLI-only: mutates live deployment and requires environment approval
- * - `dashboard logs`   — intentionally CLI-only: streams logs that may emit sensitive data (DB passwords, app secrets)
- *
- * Source-gated sensitive commands (security — CLI-only, never MCP-exposed):
- * - `gateway backup`       — secret-bearing: writes CA private key material to a tarball; CLI-only
- * - `cliproxy keys list`   — secret-disclosing: prints live bearer tokens in plaintext; CLI-only
- * - `cliproxy keys add`    — mutating: creates live bearer tokens on the proxy; CLI-only
- * - `cliproxy keys remove` — mutating: revokes live bearer tokens on the proxy; CLI-only
- * - `cliproxy config get`  — secret-disclosing: dumps management config incl. management key; CLI-only
- * - `cliproxy config set`  — mutating: overwrites CLIProxyAPI runtime config; CLI-only
- * - `vpn deploy`           — mutating: deploys WireGuard config to live VPN box; CLI-only
- * - `vpn logs`             — sensitive: streams journalctl logs that may reveal peer IPs/traffic; CLI-only
- * - `vpn client add`       — mutating: generates keypair + appends peer + triggers redeploy; CLI-only
- * - `vpn client list`      — sensitive: lists peer public keys and tunnel IPs; CLI-only
- * - `vpn client remove`    — mutating: removes peer + triggers redeploy; CLI-only
- *
- * A defense-in-depth backstop also denies these in opencode.jsonc `permission`
- * so that even if MCP_ALLOWLIST were mistakenly re-expanded, opencode's native
- * tool permission check would block execution. Both layers are enforced by
- * the `gates every sensitive infra MCP tool` test in conventions.test.ts.
- */
-export const MCP_ALLOWLIST: ReadonlySet<string> = new Set([
-  'gateway status',
-  'cliproxy status',
-  'cliproxy models',
-  'keeweb status',
-  'umami status',
-  'dashboard status',
-  'vpn status',
-  'status',
-])
-
-export function registerMcp(cli: ReturnType<typeof goke>): void {
-  cli.command('mcp', 'Start a stdio MCP server exposing all CLI commands as tools for coding agents').action(
-    createMcpAction({
-      cli,
-      commandFilter: name => MCP_ALLOWLIST.has(name),
-    }),
-  )
-}